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AMENDMENTS T O THE CLAIMS 
This listing of claims will replace all prior versions and listings of claims in the application. 
Listing of Claims: 

1. (Currently Amended) A method comprising: 

establishing a packet tunnel having a source network address and a destination network 
address; 

detecting a network attack; 

selecting a new network address for at least one of the source network address and the 
destination network address xxpon detecting the network attack; and 

establishing a new packet tunnel using the new netwotk address , whaein tihe new packet 
tunnel comprises two or more concatenated packet tunnels. 

2. (Original) The method of claim 1 , wherein the source network address and the destination 
network address comprise port numbers. 

3. (Original) The method of claim 1, wherein the source network address and the destination 
network address comprise Inteniet Protocol (IP) addresses. 

4. (Currently Amended) The method of claim 1 , wherein detecting a network attack 
comprises detecting an attack on an access link coupling ^ a destination network device to ^ a 
network. 
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5. (Original) The method of daim 1, further comprising: 

reserving for the packet tunnel an amount of bandwidth within an access link coupled to a 
destination network device that terminates the packet tunnel; 

upon detecting the network attack, canceling the reserved bandwidth fot the packet 
tunnel; and 

reserving for the new packet tunnel an amount of bandwidth within the access link. 

6. (Original) The method of daim 1, further comprisiiigexchangu^ 

addresses between a source network device originating the packet tunnel and a destination 
network device terminating llie padcet tumieL 

7. (Original) The meOiod of claim 1, further comprising: 

maintaining a set of available network addresses; 

selecting one of the network addresses as the new network address; 

establishing a new packet tunnel using the new network address for the destination 

address; and 

reserving for the new packet tunnel an amount of bandwidth within an access link* 

8. (Currently Amended) The method of claim 1 , wherein establishing a new packet tunnel 
iising the new network address further comprises: 

selecting an intermediate network device; 

establishing a first packet tunnel that terminates on the intermediate network device; and 
establishing a second packet tunnel that originates from the intermediate network device. 

9. (Currently Amended) The method of claim 8, jfhrther comprising: 

sending a message ftom a destination network device to a soui:ce network device 
instructing the source network device to establish the first packet tunnel with the intermediate 
network device; and 

reserving for the second padcet tunnel an amount of bandwidth within an access link 
coupling the destination network device to 4i*e a networic* 
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10. (Qtiginal) The method of claim 9, fiirther comprising: 

establishing a secure sigaalmg channel between the source netwoik device and flie 
destination network device; and 

sending the message via the secure signaling channel. 

1 1 . (Original) The method of claim 8, further coiB3)rising 

de-encapsulating at the intertnediate network device packets received from the first 
packet tunnel; and 

re-»capsulating the packets at the intermediate n^ork device for communication via 
the second packet tunnel. 

12. (Original) The method of daim 8, further comprising: 

establishing a secure signaling channd between a source network device and a destination 
network device; 

sending via the secure signaling diannel control packets b^een the source network 
device and the destination network device to monitor the perfonnance of the first and second 
packet tunnels; and 

selecting a new intemjediate network device when the perfbimancc reaches a minimum 
threshold. 

13. (Original) The mediod of claim 12, further comprising maintaining a set of possible 
intermediate network devices, and wherein selecting the intermediate network device comprises 
selecting one of the possible intermediate network devices fixmi the $et. 

14. (Original) The method of claim 5, whcrdn reserving an amount of bandwidth comprises 
sending a reservation message from a destination network device terminating the packet tunnel to 
a service provider access device. 
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15. (Original) The method of claim 14, wherein sending a reservation message comprises 
saiding the reservation message according to the Resource Reservation Protocol (RSVP). 

1 6. (Original) The method of claim 1 , v^herein establishing a packet tunnel comprises: 

maintaining a set of available multi(^t network addresses; 

selecting one of the multicast network addresses for the packet tunnel; and 

subscribing to a multicast channel for the selected multicast network address. 

17. (Original) The method of claim 16, wherein establishing a new packet tunnel comprises: 

unsubscribing to the multicast channel; 

selecting one of the multicast netwoik addresses for the destin ation network address; 
establishing a new packet tunnel using the new destination address; and 
subscribing to a multicast channel for the selected multicast netwcnk address. 

18. (Withdrawn) A method comprising: 

establishing a packet tunnel having a source network address and a destination networi^ 
address; and 

establishing for the packet tunnel a truncated reservation path within an access link 
coupled to a destination network device that tenninates the packet tunnel. 

1 9. (Withdrawn) The method of claim 1 8, wherein the source network address and the 
destination network address comprise port numbers. 

20. (Witiidrawn) The method of claim 18, wherdn the source network address and the 
destination network address comprise Intemet Protocol (IP) addresses. 

21 . (Withdrawn) The method of claim 18, wherein establishing a truncated reservation path 
comprises issuing a reservation command from the destination device to reserve an amount of 
bandwidth within the access link for the padcet tunnel. 
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22. (Withdrawn) Themcthodofdaim 18, further oomprism^^ 
detecting a network attack; and 

canceling the truncated reservation path for the packet tunnel upon detecting the network 

attack. 

23- (Withdrawn) The rnethod of claim 22, further comprising: 

establishing a new packet tunnel npon detecting the network attack; and. 
reserving for the new packet tunnel an amount of bandwidth within the access link. 

24. (Withdrawn) The method of claim 1 8, wherein establishing a truncated reservation path 
comprises sending a reservation message from a destination network device terminating the 
packet tunnel to a service provider access device coiq)led to the destination network device via an 
access link, whmin the res^vation message indicates that packet flow for the tunnel temiinfttes 
with the destination device. 

25. (Withdrawn) The method of claim 24, wherein sending a reservation message comprises 
sending the reservation message according to the Resource Reservation Protocol (RSVP). 

26. (Withdrawn) The method of claim 18, wherein detecting a network attack comprises 
detecting an attack on an access link coupling the destination network device to the network. 

27. (Original) A method comprising: 

establishing virtual private network service including a packet tunnel having a source 
network address and a destination network address; 
detecting a network attack; and 

establishing new virtual private network service \ipon detecting the network attack, 
wherein the new virtual private network service comprises two or more concatenated packet 
tunnels. 
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28. (Original) The method of daim 27, wherein establishing the new virtual private network 
service comprises: 

selecting an intermediate network device upon detecting the networic attack; 

establishing a first packet tunnel from the source network address and terminating on the 
intermediate network device; and 

establishing a second packet tunnel origmating from the intennediate network device and 
terminating at the destination network address. 

29. (Original) The method of claim 27, wherein establishing a packet tunnel comprises: 

maintaining a set of available mfulticast network addresses; 

selecting one of the multicast network addresses for the destination network address of 
the packet tunnel; and 

subscribing to a multicast chamiel for the selected multicast networic address. 

30. (Currently Amended) The method of claim 27, wherein detecting a network attack 
comprises detecting an attack on an access link coupling Ae g destination network device to &e a 
network. 

31. (Withdrawn) A method comprising: 

maintaining a set of alternate multicast network addresses and a set of al ternate unicast 
network addresses; 

assigning one of the multicast network addresses to a packet tunnel terminating on a 
network device; and 

assigning one of the unicast network addresses to a packet tunnel originating fix)m the 
network device. 

32. (Withdrawn) The method of claim 31, further comprising: 

detecting a network attack; and 

selecting a new multicast network address for the packet tunnel terminating on the 
network device upon detecting the network attack. 
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33. (Withdrawn) The method of claim 3 1 , ftirther comprising subscribing to a multicast 
channel for the multicast network address assigned to the packet tunnel temiinating on the 
network device. 

34. (Withdrawn) The method of claim 33» further comprising: 

detecting a n^work attack; 
unsubscribing to tibe multicast channel; 

selecting a new multicast network address for the packet tunnel temiinathig on the 
network device upon detecting the network attack; and 

subscribing to a new multicast channel for the new multicast network address. 

35. (Currently Amended) A system coxnprising 

a source device coupled to a network; and 

a destination device coupled to the network, wherein the source device and the 
destination device establish a packet tunnel having a source network address and a destination 
network address and, upon detecting a network attack, select a new network address for at least 
one of the source network address and the destination network address and establish a new 
packet tunne l, wherein the new packet tunnel comprises two or m ore concatenated packet 
tunnels . 

36- (Original) The system of claim 35, wh^ein the source network address and the destination 
network address comprise port numbers. 

37. (Original) The system of claim 35, wherein the source network address and the destination 
network address comprise Internet Protocol (IP) addresses. 

38. (Currently Amended) The system of claim 35, wherein the destination device and the 
network source device comprise edge routers that couple local area networks to the network. 
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39. (Curreroitly Amended) The system of claim 35, wherein the destination device detecte 
attack on an access link coupling the destination n e twork device to the network 

40. (Currently Atnended) The system of claim 35, wherein the destination device reserves for 
the packet tunnel an amount of bandwidth within an access link coupling the destination network 
device to the network, and forther wherein upon detecting the network attack the destination 
device cancels the reserved bandwidth for the packet tunnel and reserves the bandwidth for the 
new packet tunnel. 

41. (Original) The system of claim 35, wherein the destination device and the source device 
ecif^change a set of available network addresses for the source network address and the destination 
network address of tfie padcet tunnel. 

42. (Origiual) The system of claim 35» wherein the destination device comprises a storage 
medium to store a set of available network addresses for use as the source netwoik address and 
the destination network address of the packet tunnel. 

43. (Currently Amended) The system of claim 35, wherein the source device and destination 
device establish the packet tunnel by establishing a first packet tunnel that temiinates on an 
intermediate network device, and establishing a second packet tunnel that originates from the 
intermediate network device , 

44. (Original) The system of claim 43, wherein the intermediate network device de-encapsulatcs 
packets received from the first packet tunnel and re-encapsulates the packets for communication 
to the destination device via the second packet tunnel 

45. (Original) The system of claim 43, wherein the source device and the destination device 
establish a secure signaling channel and send via the secure signaling channel control packets to 
monitor the performance of the first and second packet tunnels. 
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46. (Original) The system of cl aim 45, wherein the destination device selects a new intennediate 
network device when the performance reaches a minimiim threshold. 

47. (Withdrawn) A system comprising 

a source device coupled to a network by a first access link, wherein the soiuce device 
originates a packet tunnel; and 

a destination device coupled to the network by a second access link, wherein the 
destination device terminates the packet tunnel, and further wherein the destination device 
establishes for the packet tunnel a truncated reservation path within the second access link, 

48. (Withdrawn) The system of claim 47, wh^ein the destination device issues a 
reservation command to a service provider device to reserve an amount of bandwidth within the 
second access link. 

49. (Withdrawn) The system of claim 47, wherein the destination device cancels the 
truncated reservation path upon detecting a network attack. 

50. (Wididrawn) The system of claim 49, wherein the destination device establishes a new 
padcet tunnel upon detecting the network attack and reserves for the new packet tunnel an 
amount of bandwidth within the second access link. 

5L (Cunrcntly Amended) A system comprising: 

a source netwoik device that originates a first packet tunnel; 

an intermediate network device that tmninates the iirst packet tunnel and originates a 
second packet tunnel; and 

a destination nctworic device that terminates the second packet tuimel, wherein the 
intermediate network device de-encapsulates packets received from the fibrst packet tunnel and re- 
encapsulates the packets for communication to the destination network device via the second 
packet tunnel. 
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52. (Original) The system of claim 51^ wherein the destination network devioe includes a storage 
mcdiiim to store a set of possible intenncdiate network devices, and further wherein the 
destination network device selects the intermediate network device from the set upon detecting a 
network attack. 

53. (Currently Amended) A computer-readable medium comprising instructions to cause a 
processor to: 

establish a packet tunnel having a sotirce network address and a destination network 
address; 

detect a network attack; 

select a new network address for at least one of the source network address and the 
destination netwoik address upon detecting the network attack; and 

establish a new packet tunnel using the new network address, wherein the ^ew packet 
tunnel comtmses two or more concatenated packet tunnels. 

54. (Original) The computer-readable medium of claim 53, further comprising instructions to 
cause the processor to: 

reserve for the packet tunnel an amount of bandwidth within an access link; 

upon detecting the network attack, cancel the reserved bandwidth for the packet tunnel; 

and 

reserve an amount of bandwidth for the new packet tunnel. 

55. (Currently Amended) The computer-readable medium of claim 53, further comprising 
instructions to cause the processor to: 

maintain a set of available network addresses; 
select one of the network addresses as the new netwoik address; 
establish a new packet tunnel using the new network address for the destitiation network 
address; and 

reserve for the new packet tuimel an amount of bandwidth within an access link 
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56, (Cuircntly Amended) The computer-readable medium of claim 53, ftrrthcr comprising 
instructions to cause the processor to: 

select an intermediate network device; 

establish a first packet tunnel that terminates on the intennediate network device; and 
establish a second packet turmel that originates from the intermediate network device . 
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